So I came across an interesting error today. I've got a SharePoint 2010 server setup and running a few web applications. Each of these web applications are configured with their own app pools and services accounts. They were set up months ago, and have been running fine.

Today, I'm trying to set up a couple new web applications with new app pools and services accounts for them. When I try to open sites associated with them, I get a 503 - Service Unavailable error. Tracing it down, I believe it's related to this: http://blog.markhaverty.com/2010/10/20/service-unavailable--http-erro.aspx. There is an existing GPO in place that is replacing the log on at batch permissions, setting it to only be 1 particular service account that is not any of my SharePoint service accounts.

I'll be talking with my AD guy about how we can fix this, but in the mean time, I'm curious as to why my existing sites are working right now. What I'm reading says that they should be failing with the same error.

Anyone have any thoughts why?

  • and you are sure your service account password havent expired? The error message looks similar to the one i got when a service account expired – Anders Rask May 5 '11 at 16:36
  • @Evan M. have you tried reseting your server/IIS. If GP has removed IIS_WPG from logon as batch job your sites will stop after restart. – Toni Frankola May 5 '11 at 17:11
  • @Anders: Talked with the AD admin, and we put a deny on for my SP server for the GPO, and everything worked fine. @Toni: That could be it. The GPO has been in place since the server was brought online ~8 months ago, but the server was put in an affected OU a couple months ago. Quite possible the server hasn't been reset in that time, though I would have expected the daily App Pool recycles to trigger it as well. – Evan M. May 5 '11 at 19:03
  • Did you find a solution to this problem or have any more information you can add to the question? – Alex Angas May 17 '11 at 2:06
  • Nothing more to add. Things work fine now that I disabled the GPO for my SharePoint machine. Thinking about it a little further, Toni's explanation makes the most sense. An App Pool recycle wouldn't be enough to adjust the account permissions, as the account's permissions ticket wouldn't change. The full system reset would be the only thing that could reset things. – Evan M. May 17 '11 at 14:07

The server was previously moved from one OU to another, picking up the GPO policy that sets the log on as batch permissions, but wasn't restarted afterwards or since. The user accounts that were running the previous Web Applications maintained their permissions, and it was only the new user accounts that were blocked. Removed the GPO restrictions, and everything worked fine.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.